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An analysis of the PNGS and AGS guidance failures and their effect on 
the powered descent trajectory has been made* The critical failures 
have been Identified and the probability of their detection by the 
crew determined* Failed system isolation using the MSFN and landing 
radar Is discussed* Finally , two possible methods for monitoring 
the onboard guidance systems are discussed and evaluated* 


INTRODUCTION 

The present IM strategy requires th^ LM to be controlled automatically 
by the guidance throughout almost ‘viw entire descent to the lunar surface. 
While the crew does not exercise spacecraft control until late in the 
descent , they can monitor the trajectory through the primary (PNGS) and 
abort (AGS) guidance systems in conjunction with navigational data 
received from the manned space flight network (MSFN) data* 

Among the functions the crew performs during the descent is that of 
detecting and isolating guidance failures before a safe abort is no 
longer possible* Some measure of confidence that the systems are 
operating satisfactorily can be achieved by comparing the trajectories 
computed by the PNGS and AGS* In addition, monitoring of the trajec- 
tories can provide failure detection, but identification of the failed 
system Is not always possible* The studies of references 1 and 2 
indicate that differencing of parameters of the two systems also provides 
failure Identification, but as before, the technique does not provide 
failed system isolation* In both cases, some other system nrust be used 
to positively identify the failed system. 

The present study is directed toward the problems involved in the 
monitoring of guidance systems and the detection and isolation of 
failed systems during the IH descent to the lunar surface* The 
report examines monitoring concepts, Identifies critical failures 
and their probability of detection by the crew. Finally, two 
techniques for providing the onboard monitoring requirements are 
evaluated. 


DESCENT TRAJECTORY 

The LM descent trajectory is divided into a braking phase, a final 
approach phase, and a landing phase. The braking phase, which starts 
at 50,000 feet pericynthion altitude and ends at a high gate altitude 
of the order of 9,000 feet, is a near fuel-optimum trajectory* The 
final approach starts at ,hi-gate and is designed to provide the crew 
visibility of the landing site and sufficient time to assess the 
landing area. The landing phase begins at a low gate altitude of 
the order of 500 feet approximately 1,500 feet from the landing site. 
The phase is designed to afford the crew time to make a close-in 
assessment of the landing site with a trajectory easy to control* 
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GUIDANCE AND NAVIGATION SYSTEMS 

Control of the IM Is through the primary navigation and guidance system 
(PNGS). Backing up the PNGS for aborts following any PNGS failure is 
the abort guidance system (AGS). In addition, the MSHN is able to 
track the IH and provide certain navigational data. 


Primary Guidance System 

The main elements of the PNGS are the guidance computer (LGC\ the 
inertial measuring unit (IMU), the display and keyboard (DSKY), the 
landing radar (LR), and the rendezvous radar (RR) or optical tracker 
(LORS). The LGC, IMU, and DSKY function as a unit, but the LR and 
RR have the capability to operate independently of the other equipment. 

The PNGS computes the descent guidance steering commands throughout 
the descent maneuver. The PNGS is initialized from lunar orbit 
navigation data processed onboard or obtained from the MSFN prior 
to separation and realined before the start of the descent bum. 

The PNGS operates as a pure inertial system to an altitude of the 
order of 25*000 feet. At this altitude, the landing radar measurement 
of altitude is combined with PNGS estimate of altitude to begin 
correcting the inertial drifts to wash out terrain altitude uncertain- 
ties. To prevent large transients in PNGS operation in the event of 
significant differences between the two altitudes, the LR altitude is 
weighted at a ratio of 0.1 with the PNGS altitude at the first update. 
The LR altitude weighting is increased from 0.1 to 0.55 at an altitude 
of the order of 15*000 feet where it remains for the remainder of the 
landing maneuver. The update of PNGS velocity by the LR begins at an 
altitude of about 15*000 feet with a weight of 0.1 increasing to 0.4 
at an altitude of the order of 5*000 feet. 


Abort Guidance System 

The primary elements of the AGS are the abort sensor assembly (ASA)* the 
abort electronics (AEA), and the DEDA. The AGS is initialized by the 
PNGS just prior to the descent bum and provides backup ascent guidance 
for abort following PNGS failure. The AGS does not provide descent 
guidance, but it can compute and display various trajectory parameters 
on the flight instruments or DEDA. 
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Manned Space Flight Network 

The discussion of reference 3 indicates the determination of the Ui state 
vector from MSFN observations is relatively poor. The position and velocity 
are determined to a 3CTaccuracy of 10 n. mi. and 120 ft/sec, respectively, 
with the errors being very nearly actually distritarfced in height, downrange, 
and crossrange. However, the MSFN measurement of R (doppler or velocity 
along the station-ill line of sight) is quite good with a 3 O' error of about 
1.5 ft/sec. The MSFN data are not processed through a statistical filter 
but are simply subjected to coordinate transformation and smoothing. Thus, 
the information delay is essentially that of transmission, perhaps of the 
order of three seconds. 


GUIDANCE FAILURE MODES 

Both the PNGS and AGS are subject to a number of failures that either 
cause a complete disruption of the output or so seriously degrade their 
performance they are of no further use for controlling the spacecraft. 
Many of the failures that the onboard guidance systems are subject to 
are detected automatically, and the crew is informed of these failures 
through caution and warning devices. Among these are the two guidance 
computers (LGC, AEA) which contain self -checks for failure detection, 
electrical power supplies, engine trim gimbals, RGS jets, and others. 
Failures of this type will be detected by the crew without difficulty. 


Failure Types 

In general, the failures that are of concern in monitoring can be 
grouped into one of two categories: (1) *$iard-over" and (2) slowly 

deteriorating. Hard-over failures, such as a gyro, cause fairly 
rapid deviations from the expected spacecraft performance. Such 
failures generally cannot endanger the crew because the slow attitude 
and translational characteristics of the IM during descent allow the 
crew time to assess the failure and take corrective action. The 
failures in the second category are more difficult for the crew to 
detect because they result only In relatively slow divergence from 
the normally expected conditions. While this type of failure creates 
no immediate danger to the crew, allowing it to persist will ultimately 
drive the spacecraft into flight conditions which reduce the possibility 
of safe abort. However, as these failures must also exist for extensive 
periods of time, thu crew is afforded a reasonable amoung of time for 
detection of the failure. 
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Primary Failure Sources 

From a guidance viewpoint, the primary area of failures that affect the 
trajectory arise from inertial measuring component characteristics. In 
the Dt, the equipment subject to these failures are the IMG (PNGS) and 
the ASA (AGS). The characteristics of major importance are gyro drifts, 
accelerometer biases, component misalinements, and other items such as 
mass unbalance and nonlinearities of the gyros and accelerometers. 


Effect of Failures on PNGS and AGS Trajectories 

The primary sources of the failures affecting trajectory computations 
arise from failed or partially failed IMG or ASA accelerometers and 
gyros. To determine the effect of these failures on the trajectories 
computed by the PNGS and AGS, the presently expected 1 CT accelerometer 
and gyro errors were inserted into the descent trajectory program. The 
deviations in the PNGS and AGS positions and velocities were then 
determined assuming a final inertial alinement five minutes prior to 
the start of descent burn. Error propagation was terminated at 
430 seconds into the descent bum, corresponding to a hi-gate alti- 
tude of the order of S,600 feet. From this, the magnitude of the 
deviations required to cause the Dd to penetrate the deadman 1 s curve 
were determined assuming that linear analysis techniques were valid. 

The actual IMG and ASA errors used in the analysis were: 

(1) accelerometer bias, scale factor, scale factor nonlinearity, 
misalinement, and cross-axis sensitivity, (2) initial platform 
misalinement, and (3) gyro drift, mass unbalance, and anisoelasticity. 
The data from the linear analysis provided the expected 1(7 deviations 
about the descent trajectory for both the PNGS and AGS as a function of 
time into the descent bum (figure 1 ) . 


FAILGRE DETECTION TECHNIQUES 

A check on PNGS performance can be obtained by using the PNGS and AGS 
estimates of the trajectory in at least two ways: (1) monitoring 

trajectory bounds or (2) differencing selected PNGS and AGS trajectoiy 
variables. 


Failure Detection by Reference Trajectory Monitoring 

In reference trajectory monitoring, the expected deviations of each 
system from the reference trajectory are determined as a function of 
time from final update or time into descent bum. The two bounds of 
selected parameters of each system can be checked at specified 
intervals of time. As long as the two guidance systems agree, there 
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is a high probability that both systems are working. (There is a certain 
probability that both systems have almost identical failures in which case 
both trajectories would be wrong but agree.) On the other hand, if the 
expected limits of either system are exceeded, there is a high probability 
that a failure of some type has occurred, and the crew must decide which 
system has failed. The decision as to which one has failed is not 
altogether easy for the trajectory bounds do not provide an immediate 
answer,, Assume, for example, that the AGS limits have been exceeded 
and that the PNGS is within the expected limits. On the surface, it 
would appear that the AGS had failed because the PNGS is on trajectory 
whereas the AGS is not. Remember, though, that the PNGS is insensitive 
to IMU errors and that the LGC accepts the IMU outputs as being correct 
and computes the trajectory based on the available sensor outputs. That 
is, the trajectoxy is adjusted to meet the sensor data. Hence, even 
though the AGS trajectory is out of limits, it can be indicating a 
PNGS failure. 


Failure Detection by PNGS-AGS Trajectory Differencing 

Failure detection can also be performed by using the difference between 
the PNGS and AGS trajectory parameters (reference 1). In this technique, 
the expected 3(7 differences (or any other desired difference level) of 
PNGS and AGS trajectory parameters are precalculated and plotted on 
charts as a function of time from the start of descent burn. For 
failure detection, the PNGS/AGS difference is determined at specific 
time intervals during the descent and compared to the expected 37 
difference for that time. If the difference is within the 3 7 bounds, 
both systems are assumed to be functioning correctly* if the difference 
exceeds the 3(7 difference, one of the two systems is assumed failed. 

For the latter event, the crew still has the problem of determining 
which one has failed. 


GUIDANCE SYSTEM FAILURE ISOLATION 

Regardless of the type of failure detection technique employed, the use 
of only two systems does not provide a positive identification of the 
failed system. In the case of the IM, three systems are available for 
this purposes (1) landing radar, (2) rendezvous radar, and (3) MSFN. 

The landing radar should provide a useful measure of altitude after 
some 200 seconds into the descent burn and altitude rate data some 
100 seconds later (reference 4) * The rendezvous radar provides usable 
CSM-LM relative range and range-rate data throughout most of the braking 
phase. MSFN tracking data of primary significance are velocities, in 
particular range rate between the IM and earth-based MSFN tracking 
stations. Note, however, that once the PNGS has been updated by the 
landing radar, the two systems are no longer independent, and the radar 
cannot (rather should not) be used for failure isolation thereafter. 
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Isolation of Failed System 

Once it has been established that a guidance system has failed, the 
procedures for isolation are straightforward. The use of the three 
systems is: 

Landing Radar - The landing radar measurement of altitude can be compared 
directly with the PNGS and AGS estimates of altitude following the detec- 
tion of a failure. The primary disadvantage ia that the terrain altitude 
uncertainty may require an extremely large difference to exist between 
the two systems before a positive identification can be made. Later on 
in the descent burn, the measurement of altitude rate can be used for a 
direct check of PNGS and AGS altitude rate estimates which gives a 
fairly quick isolation check as only the radar velocity uncertainties 
must be considered. 

Rendezvous Radar - The rendezvous radar measurement of range-rate must 
be compared against a chart showing expected time history of range rate 
as the LGC and AEA do not compute this variable. Following a failure, 
it must be assumed that the PNGS has failed if the RR measure of range 
rate does not agree with the chart and AGS failed if the measured 
range rate agrees with the cart. The system can be used during the 
entire braking phase. 

MSFN - As in the case of the RR, the MSFN measurement of station-Di range 
rate must be compared to a chart showing the nominally ejected range rata 
for the particular landing site as neither the LGC or AEA have programs 
to compute this. From the viewpoint of crew operations, it would be better 
to compare altitude rate directly, but the expected velocity uncertainty 
along the moon radius vector and IM almost precludes this. However, as 
the station-IM range rate is well defined for a specified pericynthion 
and subsequent powered descent trajectory, the use of station-LM range 
rate provides a sufficient means of failure isolation. Use of range rate 
following a failure requires that the MSFN measurement be compared to a 
chart showing a time history of expected range rate for the given landing 
site. If the MSFN measurement agrees with the expected range rate, the 
AGS is assumed to be failed. Should the MSFN measurement disagree with 
the expected range rate, the crew must assume the PNGS has failed. 


RESULTS AND DISCUSSION 

Providing a scheme for the detection and isolation of failures requires 
a knowledge of the effect of various failures on the PNGS and AGS and 
the magnitude of failures that can be detected. Because the guidance 
monitoring is based on maximizing the probability of safe abort, the 
failures of primary concern are those having the greatest effect on 
altitude and altitude rate. In particular, it is necessary to deter- 
mine the magnitude of the failures that cause the I M to penetrate the 
deadmar^s curve and to establish the probability of their detection by 
the crew. 
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Trajectory Deviations Required to Penetrate Deadman* s Curve 

The deviations in altitude, altitude rate, and lateral velocity arise 
principally from X and Z-axis accelerometer bias, X-axis and XY cioss-axis 
accelerometer misalinements, and X- and Y-axis gyro drifts « To obtain 
the trajectory deviations causing penetration of the deadman *s curve, 
these errors were added linearly to the reference trajectory. Figure 2 
contains the altitude-altitude rate profile of the normal descent plus 
deadman »s curves for T/V ratios of 0.35 and 0.55 (roughly the expected 
ratios for the descent engine in the region of interest). The PNGS 
deviations from the normal trajectory were then extended at various 
intervals of time to hi-gate until they passed through the two deadman *s 
curves* The multiple of 1(T deviations required to penetrate were then 
determined and have been plotted in figure 3* This figure indicates that 
6he region of principle interest lies between 300 and 430 seconds into 
the descent bum. Figure 3 shows that penetration will occur only for 
60^ trajectory deviations that have existed for some 300 seconds (600 
seconds after final allnement) and that deviations of the order of 10 7 
must exist nearly 430 seconds to cause penetration. Also, notice the 
relative insensitivity of T/W to deadman* s curve penetration, at least 
for the range of T/W considered here. For practical considerations, 
errors in the trajectory of the order of 6oCT are not likely to exist 
unless something is radically wrong with either the spacecrafr or 
guidance system. The lower deviations causing penetration of the deadmai*s 
curve near 430 seconds are reasonable but still represent highly degraded 
guidance operation. 


Magnitude of Component Errors Required for Deadman Curve Penetration - 
The magnitude of the individual errors required to drive the LM into 
the deadman 1 s curve can be calculated using the formulas 



where is the number of 1 CT of the error source required for 

deadman curve penetration 

Ktfis the multiple of 10” trajectory deviations of the combined 
error sources causing deadman curve penetration 

CT M (t) is the normal UT trajectory deviation at time t 

CTMjjj(t) is the nornal 1 (J error source contribution toOji(t) at time t 


Using the information f.vom figures 1, 2, and 3, the values for Kx for the 
PNGS were calculated and have been tabulated in table 1. 
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Table 1 - Size of failure for deadman curve penetration 
Probability of Crew Detecting Errors 

After determining the magnitude of the errors that cause penetration of 
the deadman'® boundary, it is necessary to determine the level of the 
component errors the crew is able to detect® While the effort in this 
report is basically aimed at detecting errors causing penetration of 
the deadman *s curve, it should be apparent that the same principle can 
be applied to the other trajectory variables. However, a complete 
analysis of the entire trajectory is beyond the scope of this effort, 
and from the viewpoint of providing safe aborts, not expressly required. 

Theory of Detection - The principle effect of errors in the IMU and ASA 
is to cause an off-nominal trajectory. This off-nominal trajectory will, 
at some time, exceed the expected normal 3 O' boundary. Now, if only 
the error source is considered, once the mean error forces jbhe normal 
30" boundary deviation to be exceeded, the crew would have an indication 
of failure by time tj as shown on the figure A below. 


Tra j ectory 
Variable 
Magnitude 





Figure A = Determination of Probability of Detecting Errors 
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However, the statistical properties of the remaining error sources cause 
a Gaussian distribution about the new trajectory. Because of this, the 
actual trajectory Is equally likely to be above or below the mean. Hence, 
there is exactly a 50 % chance of detecting the error at t-j. Now if the 
trajectory is allowed to deviate further, the chance of detection increases 
accordingly. At tg in the above figure, the trajectory has deviated to the 
point where the distribution about the mean lies at the -37 point of the 
remaining error sources. Hence, the crew at this time has a 99*86$ chance 
of detecting the failure. Thus, it can be seen that a correct statistical 
combination of all error sources allows the 99*86$ (or any other level of 
probability of detection) detection level to be calculated. As shown in 
As shown in reference 1, the 99.36% level can be determined using the 
equation j 


m(t) = 3 




where m(t) = mean value required for 99*86$ detection level and r ^(t) 
and are as defined previously 


Because m(t) = KQmeM ^ a function of the normal 1(7 IMU 

or ASA errors, the magnitude of component error required for a 99.86$ 
detection level is readily determined. This assumes, of course, that 
the linear analysis holds for large trajectory and component deviations. 


Magnitude of Component Failures for 99.86$ Detection Level - Using the 
numerical values associated with the individual PNGS and AGS component 
failures in equation (2) yields the results shown in tables 2 and 5. 

The table indicates the size of a failure yielding a 0.9986 probability 
of detection remains essentially constant throughout the descent for all 
failures examined (except for Y-axis gyro drift). As was the case in 
the size of PNGS failures causing penetration of the deadman f s curve, 
the failures for 0.9986 probability of detection level correspond to 
essentially complete failures except for PNGS and AGS X-axis ac§elerometer 
bias and Y-axis accelerometer misalinement. The monitoring of Y, as shown 
in table 3, will pick up an X-axis accelerometer bias failure in either 
the PNGS or AGS at approximately the same time as the monitoring of h and 
fi. Also, relatively low level failures in AGS X-axis misalinement can be 
detected early, but an X-axis gyro must essentially fall before there is 
a high probability of detection. 
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Table 2 - PNGS and AGS Failure Magnitudes for a Detection Level of 99,66$ Using 
h and tf 
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Table 3 - Magnitude of Failure for 9^.86$ Detection 
Probability by Monitoring Y 
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Margin of Safety In Failure Detection - There is initially a considerable 
margin of safety In detecting the errors resulting in penetration of the 
deadman*s curve. This is shown quite clearly in figure B which shows the 
two curves for an X-axis accelerometer bias error. At 300 seconds into 
the burn, it requires roughly an error 15 times greater than the error 
required for 99. 36# level of detection to drive the IM into the deadman's 
curve. The ratio decreases to 3s 1 at 400 seconds and to 2s 1 at 430 
seconds, which is still a comfortable safety margin. It must be noted 
that both these curves were calculated assuming no update of the PNGS 
with the landing radar. Hence, the curve is optimistic in that a much 
larger error is required for detection. However, the error required to 
cause penetration of the deadman*s curve is also greater so that the 
margin should not be radically changed, but the detailed analysis 
necessary to determine the exact effect is beyond the scope of this 
present effort. 


Error 

Magnitude 



Figure B - Margin of Safety for ‘Error Detection 


Error Analysis Summary 


The linear error analysis and the discussion of error detection reveal 
two primary items of interest to guidance monitoring — (1) the trajectory 
deviations required to cause penetration of the deadman's curve are large 
except in the region below high gate, and (2) except for Isolated cases, 
the magnitude of a failure that will assure a high level of detection 
essentially constitutes complete disruption of component function. From 
the viewpoint of being able to effect a safe abort, it would appear that 
the dynamic characteristics of the 124 preclude anything but a gradual 
penetration of the deadman^s curve. Late in the descent, the picture 
changes slightly in that smaller deviations affect the safe abort 
possibilities, but the penetration is still gradual, and the detection 
probability high. From a monitoring viewpoint, the low dynamic character- 
istics of the 124 coupled with the excessive trajectory deviations necessary 
to penetrate the deadman's curve means the crew has a relatively long time 
to assess the guidance operation before dangerous flight conditions are 
reached. The second fact indicates the crew has an extremely high 
probability of detecting any and all failures that lead to unsafe 
abort conditions. Further, while some failures may not have a high 
detection probability, neither do they radically affect the trajectory 
and consequently offer little danger to the crew. For these reasons, 
it makes very little difference whether the trajectory is monitored 
or PNGS-AGS differencing is used for failure detection. Both provide 
the same end results with about the same amount of effort on the part 
of the crew as is indicated in the following discussion. 


Reference Trajectory Monitoring 

In the trajectory monitoring scheme, the crew periodically examines 
selected trajectory variables to determine whether they be within 
their expected bounds*, The crew does not perform failure isolation 
checks unless one of the variables being monitored falls outside its 
limit. The variables selected for monitoring are contained in table 4 ; 
a possible time line of events is given in table 5 for the entire 
descent. 

Braking Phase Monitoring - During the braking phase, the crew shares 
the monitoring task. The commander monitors PNGS altitude and altitude 
rate engine T/W, and DPS fuel through the flight instruments. The 
systems engineer interrogates the DSJQC and DEDA for more precise data 
and compares these to the precomputed bounds of the monitored parameters. 
In addition, the systems engineer also checks the engine T/W and DPS fuel 
and monitors delta V through the AGS. Altitude monitoring with the LR is 
relegated to the commander and should occur as early in the descent as 
possible for comparison with the PNGS estimate of altitude MSFN provides 
the 12! with an overall velocity check and establishes earth-124 relative 
range-rate for use in guidance system failure isolation. 
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With the exception of altitude, the trajectory variables are velocities. 
The use of velocities as a primary check Is based on the assumption, 
which Is reasonable, that If the Insertion results In a correct peri- 
cynthion state vector and the landing site altitude uncertainty Is of 
the order predicted in reference 5 (RMS = 544 feet), then a safe 
trajectory is assured If the vertical and lateral velocities remain 
within their expected 30" limits. In any event, the present trajectory 
almost precludes the use of downrange position or landmarks for monitor- 
ing because of the uncertainty in correlating range and time from a 
reference trajectory Q The downrange uncertainty exists because of the 
descent engine calibration during the transfer bum which cannot be 
predicted beforehand. Crossrange position should not be affected by 
the engine uncertainties, but correct velocity limits mean the out-of- 
plane position error is within the expected bounds. Altitude is 
not required for monitoring early in the descent, but it is a required 
check later in the descent, and there is no reason to have a break in 
the monitoring procedures, and therefore, is checked to maintain 
continuity in the procedure. The monitoring of T/W> fuel, and Av 
provides a check on engine performance. 

Table 6 shows the upper and lower bounds for some of the monitored 
variables during braking. The variables do not need to be more 
accurate than the nearest 500 feet for altitude and the nearest 
5 feet/second for altitude rate because of the difficulty in reading 
rapidly changing numbers. The times shown for checking are arbitrary 
and stop at 400 seconds into the powered descent. In the actual opera- 
tional case, a series of charts or nomograms based on the expected 
trajectory and descent engine performance will probably be necessary. 

Final Approach and Landing Monitoring - Monitoring of the trajectory 
during the braking phase consists of integrating visual cues with the 
PNGS trajectory information. MSFN can still track, but, except for 
one AGS check near the half-way mark of the final approach, AGS 
monitoring is discontinued because the crew will be too busy with 
more important duties 0 In any event, the crew should be able tc 
evaluate the trajectory performance in this phase better than MSFN 
or the AGS. The commander should monitor the flight instruments, 
including the LPD and LR. The systems engineer transfers his major 
effort toward evaluating the PNGS trajectory data, comparing it with 
the LR, and informing the commander of the DSKY/LPD readout. It is 
not anticipated that extensive charts containing trajectory data can 
be used because of the small time allowed for cross checking and 
because of the very likely possibility that a change of landing site 
will be made. As long as the final approach trajectory is designed 
to be within the capability of the crew to a ssess the changes as they 
occur, visual cues and knowledge of the LPD effects on the trajectory 
should be sufficient. 


. MjaaBssaB 
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PNGS-AGS Trajectory Differencing 

The principle operation In guidance Monitoring using PNGS-AGS differencing 
requires the crew to periodically determine the difference in the PNGS 
and AGS estimates of selected variables. The difference Is then compared 
to a chart (table 7) or graph which contains the expected PNGS-AGS differ- 
ence for that time In the descent. If the difference Is less than the 
expected difference , the guidance systems are assumed to be operating 
correctly. Should the difference be greater than the normally expected 
value, one of the two systems is considered to be failed. The failed 
system is isolated using one of the three Independent systems available 
for this purpose. 

Braking Phase Monitoring - The monitoring of the two systems in this 
technique follows much the same line as for trajectory monitoring. The 
additional requirement is that the crew must difference the PNGS and AGS 
estimates of altitude, altitude rate, and lateral velocity at intervals 
along the descent. The monitoring chart used is shown in Table 7. The 
division of responsibility is essentially that of Table 4 with the major 
change being the differencing performed by the systems engineer. The 
time line of events is contained in Table 5. 

Final Approach and Landing Monitoring - Once hi-gate has been reached, 
the differencing is discontinued because the time is not available to 
perform the check. In any event, it would seem that if a guidance 
failure has not been detected by this time in the descent, there is 
very small chance of detecting it during the final approach and 
landing phase. Thus, the monitoring after hi-gate is the same as 
that for trajectory monitoring. 


CONCLUSIONS 

Based on the results of this study, the following conclusions are made: 

1 . There is a high probability of detecting guidance failures that 
lead to unsafe trajectories, but it is still possible to have failures 
that cause large guidance errors that are not readily detected by 
trajectory monitoring. 

2. Trajectory deviations of the order of 60(7 must exist for over 
300 seconds into the powered descent to cause the IK to penetrate the 
deadman 1 s curve and deviations of the order of 10(7 must exist for over 
430 seconds to cause penetration of the deadman 1 s curve. 

3. The guidance component failures causing the trajectory deviations 
cited in (2) above, except for accelerometer biases, constitute essentially 
complete failures of the components. In the case of accelerometer biases, 
component deviations of the order of 9(7 drive the IK into the deadman ! s 
curve. 
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4* Even tinder the worst possible case, the crew has a better than 
99 « 9$ chance of detecting all failures leading to unsafe abort conditions 
within 100 seconds after the start of descent burn, 

5, Either of the two monitoring techniques examined in this study 
provides the crew with a satisfactory method for detecting guidance 
system failures j however, the reference trajectory monitoring technique 
offers some time advantage over the PNGS-AGS differencing technique and 
is more in line with normal piloting procedures, 

6, With the present system configuration, there is very little 
chance that the crew will be able to identify the failed component 
using trajectory monitoring techniques, 

7, While the rendezvous radar can be used as a failure isolating 
device, it cannot be identified as being an absolute requirement for 
guidance monitoring during the IM powered descent to the lunar surface 
because the landing radar and MSFN are each capable of providing the 
additional data source required. 


RECOMMENDATIONS 

The following recommendations are made: 

1, The effect of landing radar update on the error analysis should 
be made to obtain more realistic values for the magnitude of failures 
that can be detected by the crew, 

2, An analysis should be made to determine thh- full capabilities 
of the MSFN during powered descent, 

3* A piloted simulation study should be made to evaluate thf 
guidance monitoring techniques of this report in an operational 
environment. 
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MONITORED BY 

VARIABLE 

COMMANDER 

SYSTEMS ENGINEER 

ALT 

PNGS-LR 

AGS-PNGS 

ALT RATE 

PNGS-LR 

AGS-PNGS 

EARTH - LM 
RANGE-RATE 

MSFN 


CROSSRANGE 

VELOCITY 

PNGS 

AGS-PNGS 

T/W 

Meter 

Meter 

AV 


AGS 

pjel 

Meter 

Meter 


Table 4 - Monitored Trajectory Parameters 

























trajectory monitoring 



Table 5 - Tine Line of Events 



velocity check. T/W = 5»3^ 
Notes decrease of engine 
thrust to 60% at t 
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Table 5 (Continued) 


TIME(SflC) 


FA-10 


COMMANDO* 


Alines eye with LPD for 
expected 52° reading 


FA-6 


FA-0+ 


SYSTEMS ENGINEER 


Verifies PNGS Alt = 7100 feet, 
Forward velocity = 700 ft/sec 
Thrust = (000#, Pitch att = 62 
Alt rate = 145 ft/aec, Lat vel = 0 
Calls out trajectory data over 
interphone and VHF command 


FA+10 


FA+20 


FA+30 


FA+40 


Verifies pitch to final 
approach attitude 

Evaluates visibility 
problems. Performs safety 
of flight trajectory 
evaluation. Begins search 
for landing site and aline- ; 
ment with LPD - 52°. Starts 
assessment of trajectory and 
landing site by visual cues. 


Verifies LPD reading = 52° 
and LEM ia on-traj ectory, 
site good. 


Verifies 
att and 


pitch to final approach 
6v sec *tt rate 


Verifies pitch angle = 33 
LPD reading = 52°, alt = 6100 feet, 
alt rate = 135 ft/sec, thrust = 5300, 
Calls out hi -gate event and data 
over interphone and VHF command. 


Continues LPD monitoring 
and trajectory and site 
assessment. Visually 
estimates altitude and 
evaluates altitude rate 
against values called out 
by systems engineer. 

Verifies LPD = 52° and 
on-traj ectory 

Continues visual LFD 
monitoring and trajectory 
and site assessment checks 


Calls out LPD reading, altitude, 
altitude rate, T/W, and fuel 
remaining (interphone only) 

Verifies and calls out alt = 3800 feet, 
alt rate = 95 ft/sec, pitch = 38° 
forward vel = 380 ft/sec, lat 
vel = 0 ft/sec, LPD = 52, thrust = 
5100#, fuel = 


Calls out LPD reading alt and 
alt rate (interphone only). 

Verifies and calls out over 
interphone and VHF command 
alt = 2500 feet, alt rate = 65 ft/sec, 
pitch = 38°, forward vel = 260 ft/sec 
Lat ve? = 0 ft/sec, LPD = 52, 
thrunt = 4700#, Fuel = 


21 


Table ! 'j (Continued) 


Tt*e 

j&lX. 

FA+50 

1 

COMMAND® 

f ' __ . 

SYSTEMS OJCINEEK 

Verifies visually LPD = 52° 
and that trajectory and 
site good. 

♦ 

Checks AGS alt = 
alt rate - 

Calls out LPD, alt, alt rate 
(interphone only) 

FA+60 

I 

j J 

Verifies LPD = 52° and 
continues trajectory and 
site assessment. 

Verifies alt = 1200 feet, 
alt rate = 35 ft/sec, pitch = 35° 
for vel = 140 ft/sec, LPD = 52° 
lat vel = 0 ft/sec, thrust = 4200# 

F+70 

Verifies LPD = 52° and 
trajectory and site are 
good. 

Verifies and calls out over 
phone alt = 800 feet, 
alt rate = 25 ft/sec, pitch = 32° 
for vel = 90 ft/sec, thrust = 4000# 

F+75 

1 

1 

Rotates L® from 30° to 11° 
pitch back attitude. 
Switches LR to second 
position. 

Switches PNGS from AUTO to RCAH, 
manually. Verifies fuel quantity 
level is satisfactory and relates 
this to Commander. 

L+0 

1 

i 

i 

Evaluates vehicles handling 
qualities. Verifier pitch 
att = 11°, alt = 500 feet, 
alt rate = 15 ft/sec, lat 
vel = 0, for vel = 50 ft/sec 
Verifies landing site 
satisfactory. 

Calls out lo-gate over VHF command 
and interphone. Monitors flight 
instruments and begins terrain 
assessment from right-hand window 

LrMO 

! 

Verifies pitch att = 11° 
alt = 350 feet, alt rate = 

Checks fuel status. Advises 
commander of landing site 


15 ft/sec, for vel = 40 ft/soc assessment. 
Checks landing site. Reduces 
alt rate to 8 ft/sec. 

Evaluates performance of 
rate-of-descent command 
mode. Estimates engine 
gimbal angle (roll attitude 
for zero x) 
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Table 5 (Concluded) 


f j*c I 

L+30 


COMMAND® SYSTEMS ENGINEER 

Verifies pitch att = 11° Advises Commander of fuel status, 

alt = 190 feet, for vel = 

20 ft/sec, lat = 0. 

Reduces lat rate to 5 
ft/sec. Checks landing 
site. Evaluates 
performance of rate-of- 
de scent command mode. 

Estimates gimbal angle 
(roll). 

Landing site passes from Advises Commander of landing sit< 

view. Alt = 140 feet fuel status. 

alt rate = 5 ft/sec 

forward vel = 10 ft/sec 

lat vel = 0 

Checks for dust agitation. 


L+40 


L+45 


Advises Commander of fuel status. 


Begins rotation forward and Checks for final radar update of 

nulls forward and lateral PNGCS. 

velocities. 


Advises Commander of landing site, 
fuel status. 


Lrf-50 


L+60 



Continues to null forward 
and lateral velocities. 

Notes alt = 90 feet, 
alt rate = 5 ft/sec. 

Checks fuel. Compares 
forward and lateral 
, velocity null visually. 
Estimates pitch and 
roll component of engine 
gimbal angle. 

Continues velocity nulling. 
Notes alt = 40 feet. Checks 
fuel. Estimates pitch and 
roll component of engine 
gimbal angle. 


Continues velocity muling. 
Notes alt = 30 feet, reduces 
alt rate to 4 ft/sec. Arms 
DE shutoff switch. 


Advises Commander of fuel 


Continues advisement. 


Continues advisement 


L+70 


Shuts off DE on probe light 
indication 





















































**Note Negative Increase of h 

















































Time (Sec) 
AGS 






ALTITUDE RATE (FT/SEC) 


FIGURE 2 - ALTITTJDE-ALTITUDE RATE PROFILE 





